In this episode of Phoenix Cast, hosts John, Rich, and Kyle break down the recent “hack” of McKinsey’s internal AI platform Lilly — where a security startup’s automated agent gained full root access through unsecured API endpoints in under two hours — sparking a lively debate on what actually constitutes a hack and why zero trust architecture still matters more than ever. The crew covers exciting new GenAI.mil features including Agent Builder and API key access, Anthropic’s upgrade of Claude Code’s context window from 200K to a million tokens, and what context rot means for power users. Kyle then delivers a fired-up debrief from the USMC Generative AI Workshop at Quantico, where Marines from across the Corps showcased everything from AI-powered recruiting simulations to homegrown tools, and the hosts challenge listeners to start building MOS-specific prompt libraries to multiply impact across the force. If you want a masterclass in both the promise and the pitfalls of AI adoption in the military, this one’s packed from start to finish.

We'd love to hear your thoughts! Tweet us @ThePhoenixCast, and don't forget to join our LinkedIn Group to connect with fellow Phoenix Casters. If you enjoyed the episode, help us out by leaving one of those coveted 5-star reviews on Apple Podcasts. Thanks for listening!

Links:

MCKINSEY HACKhttps://www.inc.com/leila-sheridan/an-ai-agent-broke-into-mckinseys-internal-chatbot-and-accessed-millions-of-records-in-just-2-hours/91314432

WHAT IS AN API?http://en.wikipedia.org/wiki/API

WHAT IS BOLA?https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization

OBLIGATORY XKCD: 

https://xkcd.com/327/